ISACA Certifications in 2026: CISA, CISM, CRISC, CGEIT, CDPSE, and AI Paths

ISACA’s credential portfolio spans information-systems audit, information-security management, technology risk, enterprise IT governance, privacy engineering, cybersecurity operations, and increasingly artificial-intelligence risk and security. In 2026, the organization’s long-established CISA, CISM, CRISC, CGEIT, and CDPSE certifications remain central, while newer credentials such as CCOA, AAIR, and AAISM extend the portfolio into operational security and AI governance.

The ISACA certifications are best understood by professional responsibility rather than by perceived difficulty. CISA validates audit and assurance capability, CISM focuses on managing security programs, CRISC centers on technology risk and controls, CGEIT addresses enterprise governance of information and technology, and CDPSE focuses on implementing privacy by design.

CISA is the flagship audit and assurance credential

The Certified Information Systems Auditor is designed for professionals who audit, assess, monitor, or provide assurance over information systems and technology controls. The current CISA exam contains 150 questions across five domains: the information-systems auditing process, governance and management of IT, systems acquisition and implementation, operations and business resilience, and protection of information assets.

The CISA exam therefore tests more than audit vocabulary. Candidates need to evaluate evidence, understand risk and control relationships, identify appropriate audit procedures, assess change and development practices, and determine whether operational and security controls support organizational objectives.

Passing the exam does not by itself create the certification. ISACA currently requires relevant professional experience, an application submitted within the permitted period after passing, adherence to the Code of Professional Ethics, continuing professional education, and compliance with IS audit standards. CISA holders generally maintain the designation through at least 20 CPE hours annually and 120 over a three-year reporting cycle.

CISM is aimed at people who manage security programs

The Certified Information Security Manager is oriented toward security leadership and program management rather than purely technical implementation. Its domains address information-security governance, risk management, security-program development and management, and incident management.

The CISM exam is most relevant to security managers, program leaders, governance professionals, senior consultants, and practitioners moving from technical roles into organizational responsibility. Candidates should be able to prioritize investments, align security with business objectives, establish governance, manage risk, and direct incident-management capability.

ISACA currently requires five or more years of qualifying professional experience across at least three of the four CISM domains for certification, subject to the detailed experience rules. One important 2026 timing issue is that ISACA has announced a new CISM exam content outline effective 3 November 2026, so candidates testing around that date must study the correct blueprint.

CRISC validates technology risk and control expertise

Certified in Risk and Information Systems Control is designed for professionals who identify and assess technology risk, design or evaluate responses, implement and monitor controls, and communicate risk information to decision makers. It connects enterprise-risk thinking to information systems and technology operations.

The CRISC exam is especially relevant to IT risk managers, security professionals, control specialists, auditors, and consultants who need to translate technical weaknesses into business risk. Strong candidates understand risk appetite, risk scenarios, control design, residual risk, monitoring, and how governance affects the treatment of technology risk.

Current ISACA certification requirements call for at least three years of relevant work experience across at least two of the four CRISC domains. As with the other core certifications, candidates have a defined period after passing the exam to apply and must maintain the credential through continuing professional education.

CGEIT focuses on governance at the enterprise level

Certified in the Governance of Enterprise IT is intended for professionals who help boards and senior leadership ensure that information and technology support enterprise goals. It is therefore broader than operational IT management and more strategic than a single control framework.

The CGEIT exam covers governance of enterprise IT, IT resources, benefits realization, risk optimization, and related governance responsibilities. Candidates should understand how decision rights, accountability, performance measurement, investment prioritization, risk oversight, and organizational structures influence technology outcomes.

COBIT is frequently relevant in this space because it provides a governance and management framework for enterprise information and technology. The COBIT 2019 governance discussion can provide supporting context, while the current CGEIT exam content outline remains the authoritative preparation map.

CDPSE brings privacy into engineering and system design

The Certified Data Privacy Solutions Engineer credential validates the ability to implement privacy in systems and technology. It is aimed at professionals who turn privacy requirements into technical and operational controls rather than treating privacy only as a legal or policy discipline.

The CDPSE exam is relevant to privacy engineers, architects, security practitioners, developers, compliance professionals, and consultants working on data lifecycle, privacy architecture, technical controls, and privacy-by-design practices.

Preparation should connect data inventory, minimization, access, retention, consent, de-identification, logging, protection, and system design to actual privacy outcomes. The strongest candidates can explain not only what a privacy principle says but how an application, platform, or process should be designed to satisfy it.

CCOA expands ISACA into hands-on cybersecurity operations

The Certified Cybersecurity Operations Analyst is one of ISACA’s newer credentials. It is designed to validate practical cybersecurity operations capability and on-the-job skills for professionals working in areas such as monitoring, detection, investigation, and response.

The CCOA exam represents a different emphasis from CISM. CISM is management-oriented, while CCOA is closer to operational security work. A practitioner choosing between them should consider whether the role is primarily directing a security program or performing and coordinating day-to-day security operations.

This expansion reflects the broader ISACA portfolio strategy. The organization is no longer defined only by audit credentials; it now covers governance, risk, privacy, operations, emerging technology, and AI-related disciplines.

AAIR and AAISM address AI risk and AI security leadership

ISACA introduced advanced AI credentials for experienced professionals who already hold recognized certifications and have relevant background. Advanced in AI Risk focuses on governance, lifecycle risk, and AI risk-program management, while Advanced in AI Security Management focuses on the security-management implications of enterprise AI.

The AAIR exam is aimed at established risk and advisory professionals who need to evaluate AI-specific risks such as model behavior, data dependence, governance, third-party exposure, lifecycle controls, and strategic business consequences. It is not positioned as an entry-level AI certificate.

The AAISM exam similarly builds on existing security-management expertise. These advanced credentials reflect the fact that organizations increasingly need professionals who can integrate AI into existing risk, security, audit, and governance structures rather than treating AI as an isolated technology project.

ISACA certification requires experience and maintenance after the exam

Experience requirements are not interchangeable across the portfolio. CISA, CISM, CRISC, CGEIT, and CDPSE each define qualifying work in relation to their own domains, and candidates should review the current application rules before scheduling an exam. That prevents a common planning mistake: passing a technically relevant test but discovering afterward that the documented work history does not yet satisfy the credential’s certification requirements.

A recurring source of confusion is the difference between passing an ISACA exam and becoming certified. For the established professional certifications, the exam is only one step. Candidates must meet experience requirements, pay the application fee, submit a certification application, follow the ethics rules, and comply with continuing professional education requirements.

ISACA’s current candidate guide states that candidates generally have five years from passing a certification exam to apply. Core credentials such as CISA, CISM, CRISC, CGEIT, and CDPSE require ongoing CPE, and ISACA can audit reported hours. Professionals holding multiple ISACA credentials may be able to apply qualifying CPE activity across more than one designation when the activity satisfies each program’s rules.

This maintenance model is important because the subject matter changes continuously. Audit practices evolve, regulatory expectations change, security threats shift, privacy engineering matures, and AI introduces new governance and risk questions. A professional certification is intended to represent continuing competence rather than a one-time exam result.

Choose the certification that matches the decisions you make at work

A second selection test is to compare the official domain statements with a normal week of work. The better-aligned credential should describe decisions the candidate actually makes, evidence they actually evaluate, and outcomes they are accountable for. That approach produces more useful preparation than choosing by brand recognition alone, and it makes experience-based scenario questions easier because the underlying judgment has already been practiced in real settings.

A practical way to select an ISACA credential is to ask what type of decision the role requires. If the work is primarily audit and assurance, CISA is the natural fit. If the responsibility is managing enterprise security, CISM is more aligned. If the role centers on technology risk and controls, CRISC is stronger. If the professional advises executives and boards on enterprise IT governance, CGEIT is the specialized choice. If the work implements privacy into products and systems, CDPSE is directly relevant.

CCOA is useful for hands-on cybersecurity operations, while AAIR and AAISM are advanced overlays for experienced professionals dealing with AI risk or AI security. Candidates should not collect credentials simply because they share an ISACA brand; the portfolio is deliberately segmented around different responsibilities.

For 2026 preparation, use the live ISACA exam content outline, candidate guide, and certification application requirements for the exact credential. Pay particular attention to announced blueprint changes such as the November 2026 CISM update. The strongest preparation combines current exam objectives with real professional judgment about audit, risk, governance, privacy, security, or AI.